Sigma detection rules, expert-reviewed

Suspicious DNS C2 to Microsoft Typosquat Domain

This rule detects DNS queries for the updatemicfosoft typosquatting domain used as a DNS C2 channel. The Project AK47 toolset linked to the SharePoint attacks tunnels commands over DNS to update.updatemicfosoft using an XOR key. Any resolution of this Microsoft lookalike domain indicates DNS-based command and control.

Malicious AzureHound Cloud Reconnaissance via User Agent (via azure)

This rule detects sign-ins and Graph API activity carrying the azurehound user-agent string, indicating use of the AzureHound collector to enumerate users, groups, roles, and service principals. Threat actors run AzureHound to map Azure and Entra ID attack paths before privilege escalation. Detecting the tool user-agent exposes cloud discovery activity at its source identity.

Suspicious CloudTrail Logging Tampering for Defense Evasion (via aws)

This rule detects AWS CloudTrail API calls that stop, delete, or reconfigure trails, including KMS key swaps and redirection to attacker-controlled S3 buckets. Adversaries perform these actions to blind logging and evade detection during cloud intrusions.

Malicious IAM Group Creation for SES Abuse by JavaGhost (via cloudtrail)

This rule detects creation of the IAM group AWSSESSendingGroupDoNotRename, a persistence artifact JavaGhost creates to grant SES email-sending permissions for phishing. The deceptively official group name is used to authorize continued abuse of Simple Email Service from the victim account.

Malicious JavaGhost Security Group Creation (via cloudtrail)

This rule detects creation of EC2 security groups named Java_Ghost or bearing the description We Are There But Not Visible, calling cards left by the JavaGhost actor in compromised AWS environments. These empty security groups act as a signature the group plants during its cloud phishing operations.

PowerShell: Defendnot hacktool installation via one-liner fetching dnot.sh

Flags PowerShell one-liners that reference dnot.sh and GitHub/defendnot paths consistent with Defendnot installation.

Windows Security Log: Defendnot scheduled task (defendnot) persistence via --from-autorun

Detects Defendnot persistence by alerting on scheduled task create/update activity for \defendnot with --from-autorun.

Malicious Administrator Policy Attachment for Privilege Escalation in AWS

This rule detects the AdministratorAccess managed policy being attached to a role or user through AttachRolePolicy or AttachUserPolicy, a privilege escalation step in the large-scale cloud extortion operation that leveraged leaked environment variables. Granting full admin to a controlled identity gives the actor complete account control. Detecting this exposes escalation ahead of data theft and extortion.

Malicious Cloud Attack Tooling User Agent in CloudTrail via aws (via cloudtrail)

This rule detects AWS CloudTrail activity originating from the Pacu and ScoutSuite offensive cloud toolkits identified by their user agent strings. These frameworks were used to enumerate and abuse AWS control-plane access after ~/.aws/credentials theft during the SugarCRM zero-day cloud intrusion, indicating an attacker performing hands-on-keyboard cloud reconnaissance and resource abuse.

Malicious Live Ledger Persistence via Realter HD Audio Run Key via registry_set

This rule detects the Live Ledger crypto wallet stealer establishing autorun persistence through a Run key value named Realter HD Audio, a deliberate misspelling that masquerades as the legitimate Realtek HD Audio component. Live Ledger impersonates Ledger Live to steal cryptocurrency wallet data. The forged audio driver naming is a strong host based indicator of the stealer footholding for reboot survival.

Possible Spectre Ops C2 Beacon via nico and yfat Query Parameters via proxy

This rule detects Spectre Ops stealer command and control traffic that posts to a PHP endpoint carrying the distinctive nico and yfat query parameters. These custom parameter names carry stolen data and bot identifiers to the panel. The parameter pairing uniquely fingerprints the exfiltration channel independent of the C2 host or the nonstandard port.

Possible ZharkBot C2 Beacon via socket Endpoint with Bot Parameters via proxy

This rule detects ZharkBot command and control beacons that request a /socket/ endpoint with the structured query parameters id, bld, os, mn and us reporting bot, build and host details. This fixed parameter layout encodes victim registration data to the panel. Matching the endpoint and its parameter set fingerprints the bot check-in regardless of the C2 domain in use.

Suspicious Browser Kiosk Mode Forcing Credential Entry via process_creation

This rule detects the Credential Flusher technique that launches a Chromium based browser in fullscreen kiosk mode pointed at a login URL to coerce the victim into re-entering account credentials. The captured passwords are then harvested by an accompanying StealC infostealer delivered through Amadey. The pairing of kiosk mode with an app URL is a deliberate credential prompting behavior rather than normal browsing.

Malicious Live Ledger Stealer Execution via Ledger Lives Masquerade via process_creation

This rule detects execution of the Live Ledger stealer disguised as Ledger Lives.exe, a typosquat of the legitimate Ledger Live wallet application. The malware targets cryptocurrency users and exfiltrates wallet material. The near identical process name is intended to blend with the real wallet client and is a reliable signal of the impersonation payload running.

Possible F5 TMUI Directory Traversal Exploitation Attempt

This rule detects requests to the F5 BIG-IP TMUI interface containing the dot dot semicolon traversal sequence used to bypass authentication in CVE-2020-5902 as described in NCC Group RIFT F5 TMUI intelligence. Adversaries chain this traversal against the tmui path to reach protected endpoints and achieve remote code execution so matching requests indicate exploitation attempts.